Running useful AI on a network with no route to the internet — model choice, hardware, updates across the boundary, and how to verify the gap actually holds
On ibl.ai you own all the code and the data, run it model-agnostic across any LLM, and pay with no per-seat pricing — so you can deploy anywhere, from your own cloud to a fully air-gapped network.
Last updated:
An air gap makes data exfiltration a topology problem rather than a policy problem. There is no outbound route, so nothing can leave regardless of what any component tries to do.
That constraint rules out every hosted model API by definition and forces three design decisions most AI deployments never confront: which open-weight models to host, how much GPU memory the workload actually needs, and how updates cross the boundary without becoming the weakest link.
This guide covers the sequence that works, and the verification step most teams skip — proving the gap holds rather than assuming it.
A network with no route to the internet, ideally already used for the data the AI will process, so the AI does not become the reason data moves between zones.
Memory is the binding constraint, not compute. A 32GB card comfortably serves a 27–34B model in 4-bit quantization, which covers most enterprise workloads.
Without the source you cannot verify that no component calls out, and cannot patch one that does. Air-gapped operation and code ownership are linked requirements.
A reviewed process for moving model weights and platform updates across the boundary, with provenance verification and a rollback path already agreed.
Most platforms assume connectivity in places nobody documents: telemetry, licence checks, font and icon CDNs, package registries at runtime, error reporting, and remote configuration.
Read the source; do not rely on documentation.
These fail closed and will take the system down after install.
Fonts, icons and scripts loaded from a public CDN break the UI silently.
Only models whose weights you can download qualify. Pin each by hash so the deployed state is verifiable and reproducible, which is also what makes later audits answerable.
An endpoint name is not a version; a hash is.
Open-weight licences are bespoke and often carry restrictions.
Estimate concurrent users, tokens per request and acceptable latency from a representative sample of real work, then size for the peak you actually need to serve.
Procurement into an isolated environment is slow.
Install the full stack — orchestration, retrieval, vector store, agent runtime, admin interface and logging — inside the isolated segment, with no component depending on an external service.
Model and platform updates arrive on reviewed physical media. Treat cadence, provenance verification and rollback as designed procedures rather than as incidents to improvise through.
This is the step teams skip. An air gap is a claim until it is tested, and a routine platform update can reintroduce an outbound dependency that nobody notices.
You want zero, and you want to know if that changes.
Slower, reviewed updates are a security property rather than a limitation, but the organization must consciously choose the cadence rather than letting it drift to never.
You cannot burst to a larger model when a hard task appears. Size for the workload you actually have, and route work the local model cannot handle to a human.
Logs are written and read inside the boundary in a schema you control, which is a stronger evidentiary position than any hosted deployment can offer.
Air-gapped deployment converts variable per-token cost into fixed capacity cost, which is worse at low utilization and better as request volume grows.
Boundary egress monitoring, reviewed after every change
Held-out set drawn from real internal work, re-run after each model update
Change records from media transfer to production
Internal metrics at measured peak concurrency
Consequence: The hardware is yours while the system still calls a hosted API or ships telemetry, so the gap never existed.
Prevention: Test with a deny-all egress rule and confirm the system still works before declaring it air-gapped.
Consequence: Hardware is bought for a model that is too large for the budget or too small for the task, and procurement into an isolated environment is slow to correct.
Prevention: Measure tokens per request and peak concurrency on real work first, then choose the model that fits.
Consequence: The environment drifts years behind on security patches because no procedure was agreed while attention was on the initial deployment.
Prevention: Design and rehearse the media transfer procedure during deployment, not after the first vulnerability disclosure.
Consequence: A routine update reintroduces an outbound dependency and nobody notices until an audit or an incident.
Prevention: Make egress verification a mandatory step in the change record for every platform and model update.
ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.
Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours.
Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform.
Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ.
Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity.
1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.
ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.
See how ibl.ai deploys AI agents you own and control—on your infrastructure, integrated with your systems.